October 2018 - wlug - list.wlug.org.nz

Stopping Alert Volume Going To 100%
by Lawrence D'Oliveiro 20 Jan '21

20 Jan '21

For quite a while now, I’ve been annoyed by the system notification volume going to 100% on my Debian systems, regardless of my attempts to set it to a lower level. For example, when I open the KDE System Settings app, change something, then try to close the window, the sound that accompanies the save/discard/cancel alert is always startlingly loud. I think I have finally found a fix: in your /etc/pulse/daemon.conf, put in a line saying flat-volumes = no (You should find an existing comment “; flat-volumes = yes” that indicates the default.) You can make this new setting take effect in the current session immediately without having to logout or reboot, by executing the following as the currently-logged-in user: pulseaudio -k (This kills and restarts the PulseAudio daemon for your user session.) There are several discussions of the pros and cons of this issue online, going back some years. For example, here <https://bugzilla.redhat.com/show_bug.cgi?id=1265267>. Also a mention about the “flat-volumes” setting in the ever-reliable Arch Linux Wiki here <https://wiki.archlinux.org/index.php/PulseAudio>.

1 1

Does Wi-Fi Security Really Matter?
by Lawrence D'Oliveiro 11 Apr '19

11 Apr '19

Seems the Wi-Fi Alliance is having yet another crack at coming up with a really secure protocol, this time to be called WPA3 <http://www.theregister.co.uk/2018/01/09/wi_fi_wpa3/>. Does anybody care? Remember that on the Internet, security is implemented between the endpoints, the protocols are designed not to care that everything in-between might be pawed through by eavesdroppers, or even active attackers trying to inject fake data.

1 1

Microsoft Fixes Notepad
by Lawrence D'Oliveiro 11 Dec '18

11 Dec '18

Windows Notepad has never been able to handle any newline convention other than the old DOS/Windows/CP/M one (CR-LF). Now, after so many decades, Microsoft has finally decided to give it “universal newline” capability, so it can handle lines ending in LF-only (Unix/Linux) and CR-only (old MacOS) <http://www.theregister.co.uk/2018/05/08/windows_notepad_unix_macos_line_end…>. Gee, I wonder how many lines of code that took...

2 2

AGM
by Peter Reutemann 15 Nov '18

15 Nov '18

Hi everyone For those who weren't at the meeting last night or aren't on meetup.com, the WLUG AGM is next month: https://www.meetup.com/WaikatoLinuxUsersGroup/events/246737212/ Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Booting a Raspberry-Pi 3B without using a SD-Card
by Ian Stewart 02 Nov '18

02 Nov '18

Hi, If you have a Raspberry Pi Model 3B, then you may be able use it with no micro SD-Card and have it boot Raspbian off a USB flash drive stick. I have found this possible with an Apacer AH356 64GB USB 3.1 Flash Drive<https://www.pbtech.co.nz/product/MEMAPC11464/Apacer-AH356-64GB-USB-31-Flash…> stick that I bought from PB-Tech a couple of weeks ago for $21.85. Admittedly you can buy a micro SD-card like the Apacer 64GB microSDXC UHS-I Class10<https://www.pbtech.co.nz/product/MEMAPC81064/Apacer-64GB-microSDXC-UHS-I-Cl…> from PB-Tech for $28.75 and put Raspbian onto it. So using the USB flash drive stick only saves a few dollars. However, there may be other advantages over using a USB flash drive vs. a micro SD-Card for the Raspbian OS. For example, you can shutdown the Raspberry Pi and remove the USB stick, take it to another computer, and backup your data. I also installed the Raspbian distro onto WD Elements Portable 2TB 2.5" USB 3.0 External HDD<https://www.pbtech.co.nz/product/HDDWDX2621/WD-Elements-Portable-2TB-25-USB…> which PB-Tech sell for $129. The R-Pi (with no SD-Card) would not boot this drive. Possibly because the USB drive is too slow to initialize after power on??? I also found that the R-Pi would not boot up Raspbian on an old 8GB Kingston USB flash drive. Maybe its too slow to initialize??? All the above tests were done using the current latest Raspbian release which is dated 2018_10_09. FYI: Below are details on how to install the Raspbian distro image onto a USB flash drive stick. cheers, Ian. Installing the Raspbian distro onto USB flash drive... Download the latest 1.4GB Raspbian distribution file: 2018-10-09-raspbian-stretch.zip Unzip the file to create a 4.1GB image file: 2018-10-09-raspbian-stretch.img Copy the 4.1GB image to a USB flash drive stick... $ sudo dd bs=4M if=2018-10-09-raspbian-stretch.img of=/dev/sdX status=progress conv=fsync Note: For the device /dev/sdX replace the X with the drive letter of your USB flash drive stick. e.g. /dev/sdc Insert the USB flash drive stick into the R-Pi model 3B. Remove any SD-Card that may be installed in the Raspberry Pi. Power on the R-Pi. After about 10 seconds the colourful POST display will appear, and the USB stick will commence its first boot. It will detect that it is a 4.1GB partition, expand to being a partition that fills the whole of the USB flash drive stick and reboot. The second reboot will be slow and takes about one minute. I assume it is expanding the squashed file system??? Subsequent reboots are faster.

3 6

IBM To Buy Red Hat, the Top Linux Distributor, For $34 Billion
by Peter Reutemann 01 Nov '18

01 Nov '18

'International Business Machines (IBM) is acquiring software maker Red Hat in a deal valued at $34 billion, the companies said Sunday. From a report: The purchase, announced on Sunday afternoon, is the latest competitive step among large business software companies to gain an edge in the fast-growing market for Internet-style cloud computing. In June, Microsoft acquired GitHub, a major code-sharing platform for software developers, for $7.5 billion. IBM said its acquisition of Red Hat was a move to open up software development on computer clouds, in which software developers write applications that run on remote data centers. >From a press release: This acquisition brings together the best-in-class hybrid cloud providers and will enable companies to securely move all business applications to the cloud. Companies today are already using multiple clouds. However, research shows that 80 percent of business workloads have yet to move to the cloud, held back by the proprietary nature of today's cloud market. This prevents portability of data and applications across multiple clouds, data security in a multi-cloud environment and consistent cloud management. IBM and Red Hat will be strongly positioned to address this issue and accelerate hybrid multi-cloud adoption. Together, they will help clients create cloud-native business applications faster, drive greater portability and security of data and applications across multiple public and private clouds, all with consistent cloud management. In doing so, they will draw on their shared leadership in key technologies, such as Linux, containers, Kubernetes, multi-cloud management, and cloud management and automation. IBM's and Red Hat's partnership has spanned 20 years, with IBM serving as an early supporter of Linux, collaborating with Red Hat to help develop and grow enterprise-grade Linux and more recently to bring enterprise Kubernetes and hybrid cloud solutions to customers. These innovations have become core technologies within IBM's $19 billion hybrid cloud business. Between them, IBM and Red Hat have contributed more to the open source community than any other organization.' -- source: https://linux.slashdot.org/story/18/10/28/1859245 That completely flew under the radar! I still remember from my Unix sysadmin course at uni back in the days (using IBM's AIX), when an IBM guy came in for some guest lectures and mentioned that they are ramping up their investment in Linux and also offer Linux next to their own AIX Unix systems. Well, Linux has definitely come a long way! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

3 3

'Open Source Creators: Red Hat Got $34 Billion and You Got $0. Here's Why.'
by Peter Reutemann 31 Oct '18

31 Oct '18

'Donald Fischer, who served as a product manager for Red Hat Enterprise Linux during its creation and early years of growth, writes: Red Hat saw, earlier than most, that the ascendance of open source made the need to pay for code go away, but the need for support and maintenance grew larger than ever. Thus Red Hat was never in the business of selling software, rather it was in the business of addressing the practical challenges that have always come along for the ride with software. [...] As an open source developer, you created that software. You can keep your package secure, legally documented, and maintained; who could possibly do it better? So why does Red Hat make the fat profits, and not you? Unfortunately, doing business with large companies requires a lot of bureaucratic toil. That's doubly true for organizations that require security, legal, and operational standards for every product they bring in the door. Working with these organizations requires a sales and marketing team, a customer support organization, a finance back-office, and lots of other "business stuff" in addition to technology. Red Hat has had that stuff, but you haven't. And just like you don't have time to sell to large companies, they don't have time to buy from you alongside a thousand other open source creators, one at a time. Sure, big companies know how to install and use your software. (And good news! They already do.) But they can't afford to put each of 1100 npm packages through a procurement process that costs $20k per iteration. Red Hat solved this problem for one corner of open source by collecting 2,000+ open source projects together, adding assurances on top, and selling it as one subscription product. That worked for them, to the tune of billions. But did you get paid for your contributions?' -- source: https://linux.slashdot.org/story/18/10/31/1520256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The CAP Theorem Strikes Again
by Lawrence D'Oliveiro 31 Oct '18

31 Oct '18

There is a fundamental rule with distributed databases: you can pick any two of: * Maintaining data Consistency across the entire network * Maintaining data Availability across the entire network * Being able to deal with a Partitioning of the network into two or more disconnected pieces but you can never have all three. An example of this is the outage at GitHub earlier this month <https://www.theregister.co.uk/2018/10/31/github_lost_a_network_link_for_43_…>. A link broke between the east-coast and west-coast halves of their network, and in an effort to maintain ongoing service availability on both sides of the partition, they ended up sacrificing consistency of the data. Which came back to bite them when the link was re-established, and the inconsistency could not easily be resolved.

1 0

The DNS Encryption Controversy
by Lawrence D'Oliveiro 31 Oct '18

31 Oct '18

There is a rather acrimonious argument currently going on among the Internet technorati over two different competing protocols for implementing encryption of domain name (DNS) queries <https://www.theregister.co.uk/2018/10/30/doh-contorversy/>. One of them is called “DNS-over-TLS” and the other is “DNS-over-HTTPS”. The former passes the DNS queries over its own TLS-encrypted connection, while the latter piggybacks on good old HTTP, using the latter’s TLS capability instead. The former is clearly simpler, and one might say “purer”, but the latter is deliberately designed to make it hard to tell what DNS queries a user might be making, since they become indistinguishable from regular HTTPS connections. So the question becomes, do you see this obfuscation as a good thing or a bad thing? It is intended to prevent snoops (both Governmental and non-Governmental) from invading the privacy of users, but it also blocks “legitimate” analysis of traffic by network admins trying to manage their systems as well. Clearly, you can’t do one without the other. So is the price worth paying?

1 0

Fedora 29 Released
by Peter Reutemann 30 Oct '18

30 Oct '18

'Fedora 29 is released today. Among the new features are the ability to allow parallel installation of packages such as Node.js. Fedora 29 also supports ZRAM (formerly called compcache) for ARMv7 and v8. In addition to the more efficient use of RAM, it also increases the lifespan of microSD cards on the Raspberry Pi as well as other SBCs. "Additionally, UEFI for ARMv7 is now supported in Fedora 29, which also benefits Raspberry Pi users," reports TechRepublic. "Fedora already supported UEFI on 64-bit ARM devices."' -- source: https://linux.slashdot.org/story/18/10/30/229249 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

You Can Play Over 2, 600 Windows Games on Linux Via Steam Play
by Peter Reutemann 29 Oct '18

29 Oct '18

'At the end of August, Valve announced a new version of Steam Play for Linux that included Proton, a WINE fork that made many Windows games, including more recent ones ,such as Witcher 3, Dark Souls 3 and Dishonored, playable on Linux. Just two months later, ProtonDB says there are over 2,600 Windows games that users can play on Linux, and the number is rapidly growing daily. From a report: When Valve Software launched Steam Play with Proton, it made it easier for gamers to play Windows games that hadn't yet been ported to Linux with the click of a button. Not all games may run perfectly on Linux, but that's also often the case with Windows 10, which can not play older games as well as previous versions of Windows did, even under Compatibility Mode. In only two months, the database of games that work with Proton has increased to over 2,600 -- more than half of the 5,000 Linux-native games that can be obtained through the Steam store.' -- source: https://linux.slashdot.org/story/18/10/29/1721258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Easy-to-exploit privilege escalation bug bites OpenBSD and other big name OSes
by Peter Reutemann 29 Oct '18

29 Oct '18

'Several big-name Linux and BSD operating systems are vulnerable to an exploit that gives untrusted users powerful root privileges. The critical flaw in the X.org server—the open-source implementation of the X11 system that helps manage graphics displays—affects OpenBSD, widely considered to be among the most secure OSes. It also impacts some versions of the Red Hat, Ubuntu, Debian, and CentOS distributions of Linux. An advisory X.org developers published Thursday disclosed the 23-month-old bug that, depending on how OS developers configure it, lets hackers or untrusted users elevate very limited system rights to unfettered root. The vulnerability, which is active when OSes run X.org in privileged (setuid) mode, allows files to be overwritten using the -logfile and -modulepath parameters. It also makes it trivial for low-privilege users to escalate system rights. A variety of nuances are leading to widely divergent assessments of the bug's severity. “Depending on whom you talk to, the reported severity will vary greatly,” Louis Dion-Marcil, a security researcher at GoSecure, told Ars. “I think most people will tell you it is very severe, and I would agree with them. The bug allows you to write arbitrary data to arbitrary files, which might seem trivial and not that dangerous, but it effectively allows regular, unprivileged users to elevate their privileges to the one of complete administrator of the system.”' -- source: https://arstechnica.com/information-technology/2018/10/x-org-bug-that-gives… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Zealand Chooses Google Chromebooks Over Microsoft Windows 10 For Education
by Peter Reutemann 28 Oct '18

28 Oct '18

'Google announced this week that it has signed an agreement with New Zealand's Ministry of Education to provide all state and state integrated schools in the country with Chrome Education licenses. The three-year agreement goes into effect on November 1 next month. From a report: "Starting on November 1, as part of an agreement with Google and the New Zealand Ministry of Education, all state and state-integrated schools across New Zealand will be able to start claiming Ministry-funded Chrome Education licenses to manage new and existing unmanaged Chromebooks. The Chrome Education license was developed to make device management in schools a breeze, so that teachers and students can focus on what's most important -- teaching and learning. Equipped with the Chrome Education license, schools can utilize essential education features to better support the many ways Chromebooks are used in the classroom," says Suan Ye, Head of Google for Education, Australia and New Zealand.' -- source: https://news.slashdot.org/story/18/10/28/2214209 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Linus Torvalds and Greg K-H Talk About Linux Community, Dealing with Hardware Bugs, Chromebooks Gaining Traction, Microsoft, Companies Gleaning Data and More
by Peter Reutemann 28 Oct '18

28 Oct '18

'Swapnil Bhartiya, who runs the blog TFIR, had a chance to interview Linus Torvalds at Open Source Summit in the second half of August this year. (Some context: The interview, which was published this week, took place before Mr. Torvalds said he needs to take a step back to reflect on how he has dealt with the community over the years. Since then, we have learned that Mr. Torvalds is returning to his position.) In the wide-ranging interview, Mr. Torvalds has touched a wide-range of subjects, including formulating workarounds for the problematic hardware bugs (Meltdown, Spectre), and Chromebooks gaining traction (though it is still not a machine that he could use for his work yet). He also talked about companies gleaning a lot of data about their users, regulations, (a tad bit of politics), Linux community. Greg Kroah-Hartman (aka Greg K-H) joined Mr. Bhartiya and Mr. Torvalds for the second half of the interview. On Sunday, Mr. Bhartiya published an additional interview of Mr. Kroah-Hartman.' -- source: https://linux.slashdot.org/story/18/10/28/1437239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

New SystemD Vulnerability Discovered
by Peter Reutemann 28 Oct '18

28 Oct '18

'The Register reports that a new security bug in systemd "can be exploited over the network to, at best, potentially crash a vulnerable Linux machine, or, at worst, execute malicious code on the box" by a malicious host on the same network segment as the victim. According to one Red Hat security engineer, "An attacker could exploit this via malicious DHCP server to corrupt heap memory on client machines, resulting in a denial of service or potential code execution." According to the bug description, systemd-networkd "contains a DHCPv6 client which is written from scratch and can be spawned automatically on managed interfaces when IPv6 router advertisements are received." OneHundredAndTen shared this article from the Register: In addition to Ubuntu and Red Hat Enterprise Linux, systemd has been adopted as a service manager for Debian, Fedora, CoreOS, Mint, and SUSE Linux Enterprise Server. We're told RHEL 7, at least, does not use the vulnerable component by default. Systemd creator Leonard Poettering has already published a security fix for the vulnerable component -- this should be weaving its way into distros as we type. If you run a systemd-based Linux system, and rely on systemd-networkd, update your operating system as soon as you can to pick up the fix when available and as necessary.' -- source: https://news.slashdot.org/story/18/10/27/196227 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox and Google Drive: random download locations?
by Peter Reutemann 25 Oct '18

25 Oct '18

Hi everyone In case you're using Google Drive frequently in conjunction with Firefox and always wondered about the random download locations (when "always ask" is enabled), I just found the reason for this... Firefox has a boolean setting "browser.download.lastDir.savePerSite" (not defined by default) that defines whether to remember the download location per site. However, with Google Drive, you will get a random URL serving the file, turning the last known download directory into a useless feature unfortunately. So, just go into "about:config", and create the above mentioned boolean setting and use "false" as the value. Now you have a "global" last known download location. -- source: https://support.mozilla.org/en-US/questions/925960 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

New Study Claims Data Harvesting Among Android Apps Is 'Out of Control'
by Peter Reutemann 25 Oct '18

25 Oct '18

'A new study from Oxford University revealed that almost 90 percent of free apps on the Google Play store share data with Alphabet. "The researchers, who analyzed 959,000 apps from the U.S. and UK Google Play stores, said data harvesting and sharing by mobile apps was now 'out of control,'" reports TechSpot. "'We find that most apps contain third party tracking, and the distribution of trackers is long-tailed with several highly dominant trackers accounting for a large portion of the coverage,' reads the report." From the report: It's revealed that most of the apps, 88.4 percent, could share data with companies owned by Google parent Alphabet. Next came a firm that's no stranger to data sharing controversies, Facebook (42.5 percent), followed by Twitter (33.8 percent), Verizon (26.27 percent), Microsoft (22.75 percent), and Amazon (17.91 percent). [I]nformation shared by these third-party apps can include age, gender, location, and information about a user's other installed apps. The data "enables construction of detailed profiles about individuals, which could include inferences about shopping habits, socio-economic class or likely political opinions." Big firms then use the data for a variety of purposes, such as credit scoring and for targeting political messages, but its main use is often ad targeting. Not surprising, given that revenue from online advertising is now over $59 billion per year. According to the research, the average app transfers data to five tracker companies, which pass the data on to larger firms. The biggest culprits are news apps and those aimed at children, both of which tend to have the most third-party trackers associated with them.' -- source: https://yro.slashdot.org/story/18/10/24/2340207 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The World’s First Video Game?
by Lawrence D'Oliveiro 24 Oct '18

24 Oct '18

Tennis For Two, almost certainly the first computer-controlled real-time video game, 60 years old this month <https://www.theregister.co.uk/2018/10/22/tennis_for_two_at_60/>. Note this was an analog computer, which would have been faster at simulating the physics than the digital ones available in 1958.

1 0

Google News App Bug Is Using Up Gigabytes of Background Data Without Users' Knowledge
by Peter Reutemann 23 Oct '18

23 Oct '18

'A bug in the Google News app for Android is reportedly causing the app to use up excessive amounts of background data, leading to overage charges. "According to dozens of posts on the Google News Help Forum, users have been experiencing this issue as early as June," reports The Verge. "The issue was verified and addressed by a Google News community manager in September, stating that the company was investigating and working toward a fix, but the issue is still ongoing." From the report: Verge reader Zach Dowdle emailed in with his experience, and screenshots of his app and Wi-Fi data usage: "The Google News app is randomly using a ridiculous amount of background data without users' knowledge. The app burned through over 12 gigs of data on my phone while I slept and my Wi-Fi had disconnected. It lead to $75 in overage charges." According to several users, the app burned through mobile data despite having "Download via Wi-Fi" turned on in the settings. In some extreme cases, the Google News app used up to 24GB of data, leading to overage charges of up to $385, users reported. So far, the only solutions seem to be disabling background data, and deleting the app altogether. ' -- source: https://tech.slashdot.org/story/18/10/23/0340211 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Mozilla Is Reportedly Going To Sell VPN Subscriptions Within Firefox
by Peter Reutemann 23 Oct '18

23 Oct '18

'Mozilla is reportedly preparing to offer a VPN service for Firefox users to help protect them when surfing the web. According to Trusted Reviews, Mozilla has partnered with the ProtonVPN service, "with a new notification piping-up when the browser detects an unsecured connection, or in a scenario when VPN might be preferable to users." >From the report: However, it appears Firefox users will have to pay for the privilege. Austrian site Soeren-hentzschel reports the premium VPN service will be $10 a month, which is what ProtonVPN charges its users. Users will receive a "Firefox Recommends" pop-up when browsing an unsecured wireless network. The pop-up says the VPN service will provide a "private and secure' internet connection. According to the reports, a subset of Firefox 62 users in the United States will begin receiving the pop-up from today. Mozilla will reportedly get a cut of any subscription fee handed over by users to access the VPN service. MSPowerUser points out that this will be the first advertised service that costs money for Firefox users.' -- source: https://tech.slashdot.org/story/18/10/23/0351220 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox 63 Arrives With Enhanced Tracking Protection, Search Shortcuts, and Picture-in-Picture on Android
by Peter Reutemann 23 Oct '18

23 Oct '18

'Mozilla today launched Firefox 63 for Windows, Mac, Linux, and Android. The release brings Enhanced Tracking Protection, performance improvements on Windows and macOS, search shortcuts, and Picture-In-Picture on Android. From a report: Firefox 63 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play. According to Mozilla, Firefox has about 300 million active users. In other words, it's a major platform that web developers must consider. Firefox 63 for desktop brings support for Enhanced Tracking Protection. [...] Firefox 63's Enhanced Tracking Protection blocks cookies and storage access from third-party trackers, which Mozilla says targets the problem of cross-site tracking without breaking sites and impacting revenue streams like the original Tracking Protection. It does this by preventing known trackers from setting third-party cookies -- the primary method of tracking across sites -- but still gives you the option to block all known trackers (under Firefox Options/Preferences). [...] Search shortcuts essentially pins sites like Google and Amazon on the new tab page. When you click or tap them, you're redirected to Firefox's awesome bar, which automatically fills the corresponding keyword (@google or @amazon in this case) for the search engine. This way, you can type your query, hit enter, and get your search results without having to first load the Google or Amazon homepage. [...] The only major new feature for this Firefox for Android release is a picture-in-picture mode (Android Oreo and up). This means that if you're watching a video in full-screen, when you switch away from Firefox it will move the video into a small floating window, which you can tap to return to the full video player.' -- source: https://news.slashdot.org/story/18/10/23/149223 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Richard Stallman Announces GNU Kind Communication Guidelines
by Peter Reutemann 23 Oct '18

23 Oct '18

'Richard Stallman has announced the GNU Kind Communication Guidelines, an effort "to start guiding people towards kinder communication." The Guidelines differ from a Code of Conduct in that it's trying to be proactive about kindness around free software development over being rules with possible actions when breaking them. These new GNU communication guidelines can be found at GNU.org along with Stallman's commentary. >From the guidelines: A code of conduct states rules, with punishments for anyone that violates them. It is the heavy-handed way of teaching people to behave differently, and since it only comes into action when people do something against the rules, it doesn't try to teach people to do better than what the rules require. To be sure, the appointed maintainer(s) of a GNU package can, if necessary, tell a contributor to go away; but we do not want to need to have recourse to that. The idea of the GNU Kind Communication Guidelines is to start guiding people towards kinder communication at a point well before one would even think of saying, "You are breaking the rules." The way we do this, rather than ordering people to be kind or else, is try to help people learn to make their communication more kind. I hope that kind communication guidelines will provide a kinder and less strict way of leading a project's discussions to be calmer, more welcoming to all participants of good will, and more effective.' -- source: https://news.slashdot.org/story/18/10/23/1418225 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Motorola Becomes First Smartphone Company To Sell DIY Repair Kits To Its Customers
by Peter Reutemann 23 Oct '18

23 Oct '18

'As Apple continues to fight independent repair, Motorola has partnered with iFixit and pledged to support the right to repair movement. From a report: It is excellent news that Motorola has decided to make it as easy as possible for you to repair your phone. The company announced that it would begin selling replacement parts for all of its recent phones to customers, and it has partnered with iFixit to sell repair kits for phones like the Moto X, Z, G4, G5, and Droid Turbo 2. The kits come with tools, genuine Motorola-branded replacement parts, and instructions on how to fix your device. iFixit is currently selling replacement batteries, screens, and digitizer assemblies. "Motorola is setting an example for major manufacturers to embrace a more open attitude towards repair," iFixit wrote in a blog post announcing the partnership. "For fixers like us, this partnership is representative of a broader movement in support of our Right to Repair. It's proof that OEM manufacturers and independent repair can co-exist. Big business and social responsibility, and innovation and sustainability, don't need to be mutually exclusive."' -- source: https://hardware.slashdot.org/story/18/10/23/1526248 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Rockstar Patent Consortium
by Lawrence D'Oliveiro 23 Oct '18

23 Oct '18

Hi folks. In our discussion on patents last night, I was trying to think of the name of this consortium that had acquired the patents from Nortel when it went bust. I was pretty sure it was called “Rockstar”, and I was right: <https://www.techdirt.com/articles/20131101/15353825101/patent-troll-shell-c…>. The outfit is/was owned by Microsoft and Apple, and one of the first things it did was to sue Google and a bunch of major makers of Android devices.

1 0

Now Apps Can Track You Even After You Uninstall Them
by Peter Reutemann 22 Oct '18

22 Oct '18

'If it seems as though the app you deleted last week is suddenly popping up everywhere, it may not be mere coincidence. From a report: Companies that cater to app makers have found ways to game both iOS and Android, enabling them to figure out which users have uninstalled a given piece of software lately -- and making it easy to pelt the departed with ads aimed at winning them back. Adjust, AppsFlyer, MoEngage, Localytics, and CleverTap are among the companies that offer uninstall trackers, usually as part of a broader set of developer tools. Their customers include T-Mobile US, Spotify Technology, and Yelp. Critics say they're a fresh reason to reassess online privacy rights and limit what companies can do with user data. "Most tech companies are not giving people nuanced privacy choices, if they give them choices at all," says Jeremy Gillula, tech policy director at the Electronic Frontier Foundation, a privacy advocate. Some providers say these tracking tools are meant to measure user reaction to app updates and other changes. Jude McColgan, chief executive officer of Boston's Localytics, says he hasn't seen clients use the technology to target former users with ads. Ehren Maedge, vice president for marketing and sales at MoEngage Inc. in San Francisco, says it's up to the app makers not to do so. "The dialogue is between our customers and their end users," he says. "If they violate users' trust, it's not going to go well for them." Adjust, AppsFlyer, and CleverTap didn't respond to requests for comment, nor did T-Mobile, Spotify, or Yelp. Uninstall tracking exploits a core element of Apple's and Google's mobile operating systems: push notifications. Developers have always been able to use so-called silent push notifications to ping installed apps at regular intervals without alerting the user -- to refresh an inbox or social media feed while the app is running in the background, for example. But if the app doesn't ping the developer back, the app is logged as uninstalled, and the uninstall tracking tools add those changes to the file associated with the given mobile device's unique advertising ID, details that make it easy to identify just who's holding the phone and advertise the app to them wherever they go.' -- source: https://yro.slashdot.org/story/18/10/22/1956257 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linus Torvalds is Back in Charge of Linux
by Peter Reutemann 22 Oct '18

22 Oct '18

'At Open Source Summit Europe in Edinburgh, Scotland, Linus Torvalds is meeting with Linux's top 40 or so developers at the Maintainers' Summit. This is his first step back in taking over Linux's reins. From a report: A little over a month ago, Torvalds has stepped back from running the Linux development community. Then, in a note to the Linux Kernel Mailing List (LKML), Torvalds has said, "I need to change some of my behavior, and I want to apologize to the people that my personal behavior hurt and possibly drove away from kernel development entirely." To do, this he took time off "to change some of my behavior, and I want to apologize to the people that my personal behavior hurt and possibly drove away from kernel development entirely. I am going to take time off and get some assistance on how to understand people's emotions and respond appropriately." That time is over. Torvalds is back. Whether he'll be a kinder and gentler Torvalds remains to be seen. In the Linux 4.19 announcement, Greg Kroah-Hartman, Linux's temporary leader and maintainer of the stable branch, wrote: "Linus, I'm handing the kernel tree back to you. You can have the joy of dealing with the merge window :)"' -- source: https://linux.slashdot.org/story/18/10/22/1145234 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

And Now, For Something Remarkably Soothing ...
by Lawrence D'Oliveiro 19 Oct '18

19 Oct '18

Here is Brian Eno’s famous Windows 95 startup sound, slowed down by 40:1, so it is now nearly 4 minutes long: <https://soundcloud.com/ideoforms/windows-95-startup-sound>.

2 1

OpenBSD 6.4 Released
by Peter Reutemann 19 Oct '18

19 Oct '18

'The 45th version of the OpenBSD project has been released, bringing more hardware support (Radeon driver updates, Intel microcode integration, and more), a virtualization tool that supports the disk format qcow2, and a network interface where you can quickly join and switch between different Wi-Fi networks. Root.cz also notes that audio recording is now disabled by default. If you need to record audio, it can be enabled with the new sysctl variable. An anonymous Slashdot reader first shared the announcement. You can download it from any of the mirrors here.' -- source: https://bsd.slashdot.org/story/18/10/18/2056242 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

meeting next Monday?
by Peter Reutemann 18 Oct '18

18 Oct '18

Hi everyone Any suggestions for a topic/presentation next Monday, the last meeting before the AGM in November? Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 2

Ubuntu Linux 18.10 'Cosmic Cuttlefish' Arrives
by Peter Reutemann 18 Oct '18

18 Oct '18

'Ubuntu 18.10 Cosmic Cuttlefish, the latest version of Ubuntu, is now available to download. From a report: Under the hood, the Cosmic Cuttlefish boasts the 4.18 Linux Kernel. This updates comes with better support for for AMD and Nvidia GPU, USB Type-C and Thunderbolt, a way for unprivileged users to mount Filesystem in Userspace (FUSE) can be mounted by, and CPUfreq performance improvements. On top of this, you'll find the freshest version of GNOME 3.30. You can, of course, use other desktops, but GNOME, since Ubuntu 17.10, is Ubuntu's default desktop. You'll be glad to know that GNOME is faster than it has been for a while. That's because some nasty memory leaks have been patched. Canonical has also added some performance tweaks that didn't make it into the GNOME 3.30 upstream. Ubuntu 18.10 also comes with a new desktop theme, the Yaru Community theme installed by default, for your visual enjoyment.' -- source: https://news.slashdot.org/story/18/10/18/1840201 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 1

After $5 billion EU antitrust fine, Google will start charging for Android apps
by Peter Reutemann 17 Oct '18

17 Oct '18

'Google is adjusting to life in the EU after the $5.05 billion (€4.34 billion) antitrust fine levied against it by the European Commission earlier this year. Google is still appealing the initial ruling, which found that Google used Android to illegally dominate the search market, but for now Google will comply with the ruling and offer looser licensing agreements to Android device makers. In a post on the official Google Blog titled "Complying with the EC’s Android decision," Google outlined a few changes coming to the Google app licensing agreements that it offers to Android OEMs. As you might recall from the numerous times we've written about it, this announcement is a change to the secretive "Mobile Application Distribution Agreement" (MADA) document that is a requirement for getting access to the Play Store and other Google apps. What we think of as a commercial "Android" device comes in two parts. The core Android OS is free and open source—anyone can take it and do whatever they want with it without Google's involvement. If you want the Play Store, Google Maps, Gmail, and all the other Google apps you need to make a viable commercial smartphone, though, you need to talk to Google and sign a MADA, which comes with a ton of restrictions. Google's new MADA makes three big changes. First, Google's blog states "Android partners wishing to distribute Google apps may also build non-compatible, or forked, smartphones and tablets for the European Economic Area (EEA)." [...] Google says it will also unbundle Search and Chrome from the rest of the Google apps. [...] The last change is definitely a shocker. Breaking up Google's licensing agreement is going to have a financial impact on OEMs. As Google puts it, "Since the pre-installation of Google Search and Chrome together with our other apps helped us fund the development and free distribution of Android, we will introduce a new paid licensing agreement for smartphones and tablets shipped into the EEA." That's right, OEMs now have to pay to access the Google apps, but Google doesn't say how much. The core Android OS, Google says "will remain free and open source." [...]' -- source: https://arstechnica.com/gadgets/2018/10/google-to-charge-oems-for-android-a… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researcher Finds Simple Way of Backdooring Windows PCs and Nobody Notices for Ten Months
by Peter Reutemann 17 Oct '18

17 Oct '18

' A security researcher from Colombia has found a way of gaining admin rights and boot persistence on Windows PCs that's simple to execute and hard to stop -- all the features that hackers and malware authors are looking for from an exploitation technique. From a report: What's more surprising, is that the technique was first detailed way back in December 2017, but despite its numerous benefits and ease of exploitation, it has not received either media coverage nor has it been seen employed in malware campaigns. Discovered by Sebastian Castro, a security researcher for CSL, the technique targets one of the parameters of Windows user accounts known as the Relative Identifier (RID). The RID is a code added at the end of account security identifiers (SIDs) that describes that user's permissions group. There are several RIDs available, but the most common ones are 501 for the standard guest account, and 500 for admin accounts. Castro, with help from CSL CEO Pedro Garcia, discovered that by tinkering with registry keys that store information about each Windows account, he could modify the RID associated with a specific account and grant it a different RID, for another account group. The technique does not allow a hacker to remotely infect a computer unless that computer has been foolishly left exposed on the Internet without a password. But in cases where a hacker has a foothold on a system -- via either malware or by brute-forcing an account with a weak password -- the hacker can give admin permissions to a compromised low-level account, and gain a permanent backdoor with full SYSTEM access on a Windows PC.' -- source: https://it.slashdot.org/story/18/10/17/1849255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Former Top Waymo Engineer Altered Code To Go on 'Forbidden Routes', Report Says
by Peter Reutemann 17 Oct '18

17 Oct '18

'In the early days of what ultimately became Waymo, Google's self-driving car division (known at the time as "Project Chauffeur"), there were "more than a dozen accidents, at least three of which were serious," according to a new article in The New Yorker . From a report: The magazine profiled Anthony Levandowski, the former Google engineer who was at the center of the Waymo v. Uber trade secrets lawsuit. According to the article, back in 2011, Levandowski also modified the autonomous software to take the prototype Priuses on "otherwise forbidden routes." Citing an anonymous source, The New Yorker reports that Levandowski sat behind the wheel as the safety driver, along with Isaac Taylor, a Google executive. But while they were in the car, the Prius "accidentally boxed in another vehicle," a Camry. As The New Yorker wrote: "A human driver could easily have handled the situation by slowing down and letting the Camry merge into traffic, but Google's software wasn't prepared for this scenario. The cars continued speeding down the freeway side by side. The Camry's driver jerked his car onto the right shoulder. Then, apparently trying to avoid a guard rail, he veered to the left; the Camry pinwheeled across the freeway and into the median. Levandowski, who was acting as the safety driver, swerved hard to avoid colliding with the Camry, causing Taylor to injure his spine so severely that he eventually required multiple surgeries." This was apparently just one of several accidents in Project Chauffeur's early days.' -- source: https://tech.slashdot.org/story/18/10/17/204215 Just another reason why self-driving cars should be open-sourced... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

MongoDB Switches Up Its Open-Source License
by Peter Reutemann 17 Oct '18

17 Oct '18

'MongoDB is taking action against cloud giants who are taking its open-source code and offering a hosted commercial version of its database to their users without playing by the open-source rules. The company announced today that it has issued a new software license, the Server Side Public License (SSPL), "that will apply to all new releases of its MongoDB Community Server, as well as all patch fixes for prior versions," reports TechCrunch. From the report: For virtually all regular users who are currently using the community server, nothing changes because the changes to the license don't apply to them. Instead, this is about what MongoDB sees as the misuse of the AGPLv3 license. "MongoDB was previously licensed under the GNU AGPLv3, which meant companies who wanted to run MongoDB as a publicly available service had to open source their software or obtain a commercial license from MongoDB," the company explains. "However, MongoDB's popularity has led some organizations to test the boundaries of the GNU AGPLv3." So while the SSPL isn't all that different from the GNU GPLv3, with all the usual freedoms to use, modify and redistribute the code (and virtually the same language), the SSPL explicitly states that anybody who wants to offer MongoDB as a service -- or really any other software that uses this license -- needs to either get a commercial license or open source the service to give back the community. "The market is increasingly consuming software as a service, creating an incredible opportunity to foster a new wave of great open source server-side software. Unfortunately, once an open source project becomes interesting, it is too easy for cloud vendors who have not developed the software to capture all of the value but contribute nothing back to the community," said Eliot Horowitz, the CTO and co-founder of MongoDB, in a statement. "We have greatly contributed to -- and benefited from -- open source and we are in a unique position to lead on an issue impacting many organizations. We hope this will help inspire more projects and protect open source innovation."' -- source: https://developers.slashdot.org/story/18/10/16/2039253 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

libssh 0.8.4 and 0.7.6 security and bugfix release
by Peter Reutemann 16 Oct '18

16 Oct '18

'This is an important security and maintenance release in order to address CVE-2018-10933. libssh versions 0.6 and above have an authentication bypass vulnerability in the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials. The bug was discovered by Peter Winter-Smith of NCC Group.' -- source: https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfi… -- via twitter: https://twitter.com/FioraAeterna/status/1052294419607506944 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

So It’s Not Just Me
by Lawrence D'Oliveiro 16 Oct '18

16 Oct '18

Given the number of tech-support scam calls I’ve been getting, I was starting to feel picked on. But it turns out it’s New Zealand as a whole that’s being picked on, with “more than three-quarters” of Kiwis sampled in a Microsoft study reporting that they had been targeted by these scammers <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=121434…>. We are also more likely than any other nation (out of the 16 that took part in the survey) to experience fake popup browser notifications. But then, thinking about it, the “global average” of 62% of respondents getting the scam attempts smells rather strongly of sampling bias to me. It’s hard to believe that nearly two-thirds of the entire world population has been getting these calls ...

1 0

Paul Allen Has Died
by Lawrence D'Oliveiro 15 Oct '18

15 Oct '18

The Microsoft co-founder you didn’t hear so much about has lost his decades-long battle with cancer <https://www.aljazeera.com/news/2018/10/microsoft-founder-paul-allen-dies-ag…>. He was a philanthropist who quietly supported many causes with his riches. One of these was the Seattle Living Computer Museum <https://www.youtube.com/watch?v=Jk4J6y37OkY>, which has been working on getting various old classic machines back in working condition.

1 0

Rivals ARM and Intel Make Peace To Secure Internet of Things
by Peter Reutemann 15 Oct '18

15 Oct '18

'Rival semiconductor giants ARM and Intel have agreed to work together to manage networks of connected devices from both firms, clearing a major stumbling block to market growth of the so-called Internet of Things (IoT). From a report: Britain's ARM, a unit of Japan's Softbank, said on Monday it had struck a strategic partnership with Intel to use common standards developed by Intel for managing IoT devices, connections and data. The IoT involves connecting simple chips that detect distance, motion, temperature, pressure and images to be used in an ever wider range of electronics such as lights, parking meters or refrigerators. Some of the world's dumbest electronics devices get smarter by becoming connected into cloud networks, but also harder to protect. ARM's agreement to adopt Intel standards for securely managing such networks marks a breakthrough that promises to drive the spread of IoT across many industries, the two companies said.' -- source: https://it.slashdot.org/story/18/10/15/1338259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Software Freedom Conservancy Shares Thoughts on Microsoft Joining Open Invention Network's Patent Non-Aggression Pact
by Peter Reutemann 14 Oct '18

14 Oct '18

'Earlier this week, Microsoft announced that it was joining the open-source patent consortium Open Invention Network (OIN). The press release the two shared this week was short on details on how the two organizations intend to work together and what does the move mean to, for instance, the billions of dollars Microsoft earns each year from its Android patents (since Google is a member of OIN, too.) Software Freedom Conservancy (SFC), a non-profit organization that promotes open-source software, has weighed in on the subject: While [this week's] announcement is a step forward, we call on Microsoft to make this just the beginning of their efforts to stop their patent aggression efforts against the software freedom community. The OIN patent non-aggression pact is governed by something called the Linux System Definition. This is the most important component of the OIN non-aggression pact, because it's often surprising what is not included in that Definition especially when compared with Microsoft's patent aggression activities. Most importantly, the non-aggression pact only applies to the upstream versions of software, including Linux itself. We know that Microsoft has done patent troll shakedowns in the past on Linux products related to the exfat filesystem. While we at Conservancy were successful in getting the code that implements exfat for Linux released under GPL (by Samsung), that code has not been upstreamed into Linux. So, Microsoft has not included any patents they might hold on exfat into the patent non-aggression pact. We now ask Microsoft, as a sign of good faith and to confirm its intention to end all patent aggression against Linux and its users, to now submit to upstream the exfat code themselves under GPLv2-or-later. This would provide two important protections to Linux users regarding exfat: (a) it would include any patents that read on exfat as part of OIN's non-aggression pact while Microsoft participates in OIN, and (b) it would provide the various benefits that GPLv2-or-later provides regarding patents, including an implied patent license and those protections provided by GPLv2 (and possibly other GPL protections and assurances as well).' -- source: https://yro.slashdot.org/story/18/10/14/2140221 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The OS That Did Too Much
by Lawrence D'Oliveiro 13 Oct '18

13 Oct '18

You may have heard of the recent Windows 10 update (now withdrawn) that was causing some users to lose their files. There is an analysis of the problem, reported here <https://www.theregister.co.uk/2018/10/10/microsoft_windows_deletion_bug/>. It was a consequence of a feature known as “Known Folder Redirection”, which it seems only exists because of the drive-letter limitations of Windows. The closest analogue might be Linux mount points or symlinks, only the Windows version is more complicated, in usual Microsoft fashion. One mystery is that the bug was reported by multiple testers months before release, yet it seems their reports were ignored.

1 0

Facebook Offers Update On Recent Hack — And It's Bad. Here's How To Find Out If You Were Affected And What It Means
by Peter Reutemann 13 Oct '18

13 Oct '18

'Late last month Facebook announced the service had been hacked, resulting in the theft of data from 50 million users. Today Facebook finally issued an update on what the company's continuing investigation has found regarding the scale and scope of the attack. While the official press release presents the findings in a matter-of-fact manner, tech reporters have been quick to point out that the actual risks posed by what the attackers possess are alarming. The hackers used an exploit particular to the "View As" feature that allowed them to steal access tokens, letting the hackers take over accounts they did not already possess the passwords to. Facebook's press release notes that "the attackers already controlled a set of accounts, which were connected to Facebook friends." Starting by taking over friends of those initial accounts, the hackers stole tokens for "about 400,000" accounts. From there, the hackers used a portion of those accounts' friend lists to take over 30 million accounts. The press release is quick to note that this is less than Facebook's initial assessment that 50 million accounts had been compromised ("about 30 million actually had their tokens stolen," emphasis Facebook's).' -- source: http://digg.com/2018/facebook-hack-30-million-users-contact-info-2fa Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Apple Rebukes Australia's 'Dangerously Ambiguous' Anti-Encryption Bill
by Peter Reutemann 13 Oct '18

13 Oct '18

'Apple has strongly criticized Australia's anti-encryption bill, calling it "dangerously ambiguous" and "alarming to every Australian." >From a report: The Australian government's draft law -- known as the Access and Assistance Bill -- would compel tech companies operating in the country, like Apple, to provide "assistance" to law enforcement and intelligence agencies in accessing electronic data. The government claims that encrypted communications are "increasingly being used by terrorist groups and organized criminals to avoid detection and disruption," without citing evidence. But critics say that the bill's "broad authorities that would undermine cybersecurity and human rights, including the right to privacy" by forcing companies to build backdoors and hand over user data -- even when it's encrypted. Now, Apple is the latest company after Google and Facebook joined civil and digital rights groups -- including Amnesty International -- to oppose the bill, amid fears that the government will rush through the bill before the end of the year. In a seven-page letter to the Australian parliament, Apple said that it "would be wrong to weaken security for millions of law-abiding customers in order to investigate the very few who pose a threat." The company adds, "We appreciate the government's outreach to Apple and other companies during the drafting of this bill. While we are pleased that some of the suggestions incorporated improve the legislation, the unfortunate fact is that the draft legislation remains dangerously ambiguous with respect to encryption and security. This is no time to weaken encryption. Rather than serving the interests of Australian law enforcement, it will just weaken the security and privacy of regular customers while pushing criminals further off the grid."' -- source: https://apple.slashdot.org/story/18/10/12/1856202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Mysterious Grey-Hat Is Patching People's Outdated MikroTik Routers
by Peter Reutemann 13 Oct '18

13 Oct '18

'A Russian-speaking grey-hat hacker is breaking into people's MikroTik routers and patching devices so they can't be abused by cryptojackers, botnet herders, or other cyber-criminals, ZDNet has learned. The hacker, who goes by the name of Alexey and says he works as a server administrator, claims to have disinfected over 100,000 MikroTik routers already. "I added firewall rules that blocked access to the router from outside the local network," Alexey said. "In the comments, I wrote information about the vulnerability and left the address of the @router_os Telegram channel, where it was possible for them to ask questions." But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. The vigilante server administrator says he's been only fixing routers that have not been patched by their owners against a MikroTik vulnerability that came to light in late April.' -- source: https://mobile.slashdot.org/story/18/10/12/2052202 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Over Nine Million Cameras and DVRs Open To APTs, Botnet Herders, and Voyeurs
by Peter Reutemann 11 Oct '18

11 Oct '18

'Millions of security cameras, DVRs, and NVRs contain vulnerabilities that can allow a remote attacker to take over devices with little effort, security researchers have revealed today. From a report: All vulnerable devices have been manufactured by Hangzhou Xiongmai Technology Co., Ltd. (Xiongmai hereinafter), a Chinese company based in the city of Hangzhou. But end users won't be able to tell that they're using a hackable device because the company doesn't sell any products with its name on them, but ships all equipment as white label products on which other companies put their logo on top. Security researchers from EU-based SEC Consult say they've identified over 100 companies that buy and re-brand Xiongmai devices as their own. All of these devices are vulnerable to easy hacks, researchers say. The source of all vulnerabilities is a feature found in all devices named the "XMEye P2P Cloud." The XMEye P2P Cloud works by creating a tunnel between a customer's device and an XMEye cloud account. Device owners can access this account via their browser or via a mobile app to view device video feeds in real time. SEC Consult researchers say that these XMEye cloud accounts have not been sufficiently protected. For starters, an attacker can guess account IDs because they've been based on devices' sequential physical addresses (MACs). Second, all new XMEye accounts use a default admin username of "admin" with no password.' -- source: https://yro.slashdot.org/story/18/10/11/1925256 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Plex for Linux Now Available as a Snap
by Peter Reutemann 11 Oct '18

11 Oct '18

'Today, a very popular app, Plex Media Server, gets the Snap treatment. In other words, you can install the media server program without any headaches -- right from the Snap store. "In adopting the universal Linux app packaging format, Plex will make its multimedia platform available to an ever-growing community of Linux users, including those on KDE Neon, Debian, Fedora, Manjaro, OpenSUSE, Zorin and Ubuntu. Automatic updates and rollback capabilities are staples of Snap software, meaning Plex users will always have the best and latest version running," says Canonical.' -- source: https://linux.slashdot.org/story/18/10/11/193246 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Apache OpenOffice, the Schrodinger's Application: No One Knows If It's Dead or Alive, No One Really Wants To Look Inside
by Peter Reutemann 11 Oct '18

11 Oct '18

'British IT news outlet The Register looks at the myriad of challenges Apache OpenOffice faces today. From the report: Last year Brett Porter, then chairman of the Apache Software Foundation, contemplated whether a proposed official blog post on the state of Apache OpenOffice (AOO) might discourage people from downloading the software due to lack of activity in the project. No such post from the software's developers surfaced. The languid pace of development at AOO, though, has been an issue since 2011 after Oracle (then patron of the project) got into a fork-fight with The Document Foundation, which created LibreOffice from the OpenOffice codebase, and asked developers backing the split to resign. Back in 2015, Red Hat developer Christian Schaller called OpenOffice "all but dead." Assertions to that effect have continued since, alongside claims to the contrary. Almost a year ago, Jim Jagielski, a member of the Apache OpenOffice Project Management Committee, insisted things were going well and claimed there was renewed interest in the project. For all the concern about AOO, no issues have been raised recently before the Apache Foundation board to suggest ongoing difficulties. The project is due to provide an update this month, according to a spokesperson for the foundation.' -- source: https://apache.slashdot.org/story/18/10/11/1719238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Fwd: [NZOSS OpenChat] LCA2019 Sysadmin Miniconf -- Call for Presentations
by Peter Reutemann 10 Oct '18

10 Oct '18

Apologies for cross-posting, but I though this might be of interest to this list. Cheers, Peter ---------- Forwarded message --------- From: Ewen McNeill <...> Date: Thu, Oct 11, 2018 at 10:50 AM Subject: [NZOSS OpenChat] LCA2019 Sysadmin Miniconf -- Call for Presentations To: NZOSS Open Chat List <openchat(a)groups.nzoss.org.nz> Hi NZOSS, Linux.Conf.Au 2019 is being held in Christchurch, New Zealand at the end of January 2019 (21-25 January). Early Bird tickets are on sale *this month* (https://linux.conf.au/attend/tickets/) As usual at LCA, we (Simon Lyall and I) are running a System Administration Miniconf at LCA2019, and we're looking for your proposals for presentations: http://sysadmin.miniconf.org/cfp19.html Please pass this on anywhere else you think people might be interested. The LCA2019 Sysadmin Miniconf CFP text is included below for your convenience. Ewen PS: The Sysadmin Miniconf is part of LCA2019; you'll need a ticket to LCA2019 to attend/speak. Grab your ticket for LCA2019 while the Early Bird pricing is available :-) -=- cut here -=- Call for Presentations Linux.conf.au 2019 Systems Administration Miniconf There will be a one day mini conference on Linux Systems Administration held as part of linux.conf.au 2019. LCA2019 will be held in Christchurch, New Zealand on 21 - 25 January 2019. The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf. Please forward this CFP to your colleagues, peers, social networks, and other relevant mailing lists. Please help by encouraging submissions from people you would like to hear present at this Miniconf. This is our 13th Sysadmin Miniconf at Linux.conf.au. Previous presentations can be found at the website: https://sysadmin.miniconf.org/. Presentation Topics =================== We welcome talks on best current practice, new developments in Systems Administration, cutting edge techniques and technologies, and ways to better manage Linux environments large and small. Topics for presentations could include (but are not limited to): Virtualisation and Cloud Computing Kubernetes / Docker / Containers / Orchestration Infrastructure/Platform/Software as a Service (IAAS, PAAS, SAAS) Sysadmin Administration in a "serverless" environment (FAAS) DevOps and SysAdmin Culture Systems Administration Best Practice Monitoring and metrics. Collection, storage and presentation Networkng: IPv6, SDN (Software Defined Networking), performance DevOps, Configuration Management and provisioning Bootstrapping systems, Lifecycle Management Dealing with BYOD Backups in a virtual/distributed world Troubleshooting techniques Keeping legacy systems functioning War stories from the "Real World" Presentations should be of a technical nature and speakers should assume that members of the audience have at least a couple of years experience in professional Unix/Linux administration (many in the audience will have decades of experience). Format of Presentations ======================= We are now seeking proposals for presentations at the mini-conference. We have openings for: 15-25 minute short presentations 5-10 minute "lightning talks" Please note, due to the single day available (and whole-LCA opening before morning tea), we expect the majority of available timeslots to be 20 minutes or less, with possibly 1-2 slightly longer talks if there is space in the schedule. We have a general policy of accepting a high proportion of proposals but handing out relatively short timeslots. Please see previous years Miniconf schedules for examples of how the programme is organised. Submitting talks ================ Please note that in order to give a presentation or attend the Miniconf you must be registered (and paid up by the time the conference happens) for the main linux.conf.au conference. Presenting at the Miniconf does not entitle you to discounted or free registration at the main conference nor to priority with registration. Unfortunately the Miniconf has no budget for sponsorship of speakers. To submit a talk to the LCA2019 Sysadmin Miniconf, create an account on the LCA2019 website: https://linux.conf.au/dashboard create a speaker profile, and then select "SysAdmin Miniconf Talk" (in the "New Proposal" section of the Dashboard), or while logged into the LCA2019 site, go directly to: https://linux.conf.au/proposals/submit/sysadmin-miniconf/ Please pick a preferred length for your presentation from Short Presentation (15/20/25 minutes) or Lightning Talk (5/10 minutes) in the submission form; if you could do either (with more or less detail) use the Private Abstract field to describe the options and what you would prefer. In some cases we maybe able to add a few extra minutes to a few Short Presentations if there is any spare time left in the programme. Use the Private Abstract field to let us know a few more minutes would be useful for your presentation. Questions should be sent to: lca2019 at sysadmin.miniconf.org Dates and Deadlines =================== To encourage early submissions, priority (both of inclusion and scheduling) will be given to presentations submitted by 23:59 (any time zone) on 31st of October 2018. If you have a good presentation idea, please let us know early, even if you need time to finalise the presentation abstract. Please let us know directly if you need an early confirmation to assist you in arranging time off work or travel; we will do our best to help. 2018-10-31 - Deadline for early submissions 2018-11-18 - Deadline for submissions 2018-12-04 - LCA2019 Sysadmin Miniconf programme published 2019-01-21 - LCA2019 Sysadmin Miniconf held (Christchurch, NZ) Contact and Questions ===================== Please see our website at https://sysadmin.miniconf.org for more information on the miniconf, past presentations and presenting at it. If you have any questions please feel free to email the organisers at: lca2019 at sysadmin.miniconf.org -=- cut here -=- ―― View topic http://groups.nzoss.org.nz/r/topic/1uwhAyhI0xwJwbMnlKgBTZ Leave group mailto:openchat(a)groups.nzoss.org.nz?subject=Unsubscribe Start groups https://OnlineGroups.net -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

KDE Plasma 5.14 Released
by Peter Reutemann 09 Oct '18

09 Oct '18

'KDE has released Plasma 5.14 desktop. Among many other things, Plasma 5.14 simplifies managing multiple displays thanks to its new Display Configuration widget; Global Menus a la macOS now work also with GTK applications like GIMP; a new safeguard feature warns you if other users are logged in when you log out; and Discover now lets you install Snaps from all available channels (not just the default), orders software by release date, and shows package dependencies.' -- source: https://tech.slashdot.org/story/18/10/09/2159259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Chrome 70's Upcoming Security Change Will Break Hundreds of Sites
by Peter Reutemann 09 Oct '18

09 Oct '18

'When Chrome 70 arrives on October 16th, it will drop trust for a major HTTPS certificate provider, putting hundreds of popular websites at risk of breaking. "Chrome 70 is expected to be released on or around October 16, when the browser will start blocking sites that run older Symantec certificates issued before June 2016, including legacy branded Thawte, VeriSign, Equifax, GeoTrust and RapidSSL certificates," reports TechCrunch. From the report: [D]espite more than a year to prepare, many popular sites are not ready. Security researcher Scott Helme found 1,139 sites in the top one million sites ranked by Alexa, including Citrus, SSRN, the Federal Bank of India, Pantone, the Tel-Aviv city government, Squatty Potty and Penn State Federal to name just a few. Ferrari, One Identity and Solidworks were named on the list but recently switched to new certificates, escaping any future outages. HTTPS certificates encrypt the data between your computer and the website or app you're using, making it near-impossible for anyone -- even on your public Wi-Fi hotspot -- to intercept your data. Not only that, HTTPS certificates prove the integrity of the the site you're visiting by ensuring the pages haven't been modified in some way by an attacker. Most websites obtain their HTTPS certificates from a certificate authority, which abide by certain rules and procedures that over time become trusted by web browsers. If you screw that up and lose their trust, the browsers can pull the plug on all of the certificates from that authority. For these reasons, Google stopped supporting Symantec certificates last year after it was found to be issuing misleading and wrong certificates, as well as allowing non-trusted organizations to issue certificates without the proper oversight.' -- source: https://it.slashdot.org/story/18/10/09/008210 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Google Exposed Private Data of Hundreds of Thousands of Google+ Users and Then Opted Not To Disclose, Report Says
by Peter Reutemann 08 Oct '18

08 Oct '18

'Google exposed the private data of hundreds of thousands of users of the Google+ social network and then opted not to disclose the issue this past spring, in part because of fears that doing so would draw regulatory scrutiny and cause reputational damage, WSJ reported Monday, citing people briefed on the incident and documents. From the report: As part of its response to the incident, the Alphabet unit plans to announce a sweeping set of data privacy measures that include permanently shutting down all consumer functionality of Google+, the people said. The move effectively puts the final nail in the coffin of a product that was launched in 2011 to challenge Facebook and is widely seen as one of Google's biggest failures. A software glitch in the social site gave outside developers potential access to private Google+ profile data between 2015 and March 2018, [Editor's note: the link may be paywalled; alternative source] when internal investigators discovered and fixed the issue, according to the documents and people briefed on the incident. A memo reviewed by the Journal prepared by Google's legal and policy staff and shared with senior executives warned that disclosing the incident would likely trigger "immediate regulatory interest" and invite comparisons to Facebook's leak of user information to data firm Cambridge Analytica. Update: In an announcement Monday, Google said it was shutting down Google+ for consumers: We are shutting down Google+ for consumers. Over the years we've received feedback that people want to better understand how to control the data they choose to share with apps on Google+. So as part of Project Strobe, one of our first priorities was to closely review all the APIs associated with Google+. This review crystallized what we've known for a while: that while our engineering teams have put a lot of effort and dedication into building Google+ over the years, it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds. Google+ still receives north of 200 million page views every month on the web, according to SimilarWeb, a third-party web analytics firm.' -- source: https://yro.slashdot.org/story/18/10/08/1710208 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Greg Kroah-Hartman: Outside Phone Vendors Aren't Updating Their Linux Kernels
by Peter Reutemann 06 Oct '18

06 Oct '18

'"Linux runs the world, right? So we want to make sure that things are secure," says Linux kernel maintainer Greg Kroah-Hartman. When asked in a new video interview which bug makes them most angry, he first replies "the whole Spectre/Meltdown problem. What made us so mad, in a way, is we were fixing a bug in somebody else's layer!" One also interesting thing about the whole Spectre/Meltdown is the complexity of that black box of a CPU is much much larger than it used to be. Right? Because they're doing -- in order to eke out all the performance and all the new things like that, you have to do extra-special tricks and things like that. And they have been, and sometimes those tricks come back to bite you in the butt. And they have, in this case. So we have to work around that. But a companion article on Linux.com notes that "Intel has changed its approach in light of these events. 'They are reworking on how they approach security bugs and how they work with the community because they know they did it wrong,' Kroah-Hartman said." (And the article adds that "for those who want to build a career in kernel space, security is a good place to get started...") Kroah-Hartman points out in the video interview that "we're doing more and more testing, more and more builds," noting "This infrastructure we have is catching things at an earlier stage -- because it's there -- which is awesome to see." But security issues can persist thanks to outside vendors beyond their control. Linux.com reports: Hardening the kernel is not enough, vendors have to enable the new features and take advantage of them. That's not happening. Kroah-Hartman releases a stable kernel every week, and companies pick one to support for a longer period so that device manufacturers can take advantage of it. However, Kroah-Hartman has observed that, aside from the Google Pixel, most Android phones don't include the additional hardening features, meaning all those phones are vulnerable. "People need to enable this stuff," he said. "I went out and bought all the top of the line phones based on kernel 4.4 to see which one actually updated. I found only one company that updated their kernel," he said. "I'm working through the whole supply chain trying to solve that problem because it's a tough problem. There are many different groups involved -- the SoC manufacturers, the carriers, and so on. The point is that they have to push the kernel that we create out to people." "The good news," according to Linux.com, "is that unlike with consumer electronics, the big vendors like Red Hat and SUSE keep the kernel updated even in the enterprise environment. Modern systems with containers, pods, and virtualization make this even easier. It's effortless to update and reboot with no downtime."' -- source: https://linux.slashdot.org/story/18/10/06/1736258 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

California Bans Default Passwords on Any Internet-Connected Device
by Peter Reutemann 06 Oct '18

06 Oct '18

'In less than two years, anything that can connect to the internet will come with a unique password -- that is, if it's produced or sold in California. From a report: The "Information Privacy: Connected Devices" bill that comes into effect on January 1, 2020, effectively bans pre-installed and hard-coded default passwords. It only took the authorities about two weeks to approve the proposal made by the state senate. The new regulation mandates device manufacturers to either create a unique password for each device at the time of production or require the user to create one when they interact with the device for the first time. According to the bill, it applies to any connected device, which is defined as a "physical object that is capable of connecting to the Internet, directly or indirectly, and that is assigned an Internet Protocol address or Bluetooth address."' -- source: https://it.slashdot.org/story/18/10/05/1814242 Good bye, "admin/admin"! Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Firefox To Support Google's WebP Image Format For a Faster Web
by Peter Reutemann 06 Oct '18

06 Oct '18

'Firefox has joined Google's WebP party, another endorsement for the internet giant's effort to speed up the web with a better image format. From a report: Google revealed WebP eight years ago and since then has built it into its Chrome web browser, Android phone software and many of its online properties in an effort to put websites on a diet and cut network data usage. But Google had trouble encouraging rival browser makers to embrace it. Mozilla initially rejected WebP as not offering enough of an improvement over more widely used image formats, JPEG and PNG. It seriously evaluated WebP but chose to try to squeeze more out of JPEG. But now Mozilla -- like Microsoft with its Edge browser earlier this week -- has had a change of heart. "Mozilla is moving forward with implementing support for WebP," the nonprofit organization said. WebP will work in versions of Firefox based on its Gecko browser engine, Firefox for personal computers and Android but not for iOS.' -- source: https://news.slashdot.org/story/18/10/05/1755247 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

A Look at Facebook's Use of Systemd
by Peter Reutemann 06 Oct '18

06 Oct '18

'At an event this month (you can find the video of it here), Davide Cavalca, a production engineer at Facebook, spoke about the growing adoption of systemd at the data centers of the company. From a report: Facebook continues making use of systemd's many features inside their data centers. Some of their highlights for systemd use in 2018 includes: Facebook's servers have been relying on systemd for about the past two years. Facebook is using CentOS 7 everywhere from hosts to containers. While relying on CentOS 7, Facebook backports a lot of packages including new systemd releases, Meson, other dependencies, and of course new Linux kernel releases. Facebook is working on "pystemd" as a Python (Cython) wrapper on top of SD-BUS.' -- source: https://linux.slashdot.org/story/18/10/05/1717233 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Microsoft Is Embracing Android As the Mobile Version of Windows
by Peter Reutemann 03 Oct '18

03 Oct '18

'Microsoft unveiled a bunch of new hardware during a press event last night, but one of the most interesting announcements the company made was their new "Your Phone" app for Windows 10. Basically, the feature will let Android users mirror any app on their device to a Windows 10 desktop. The Verge's Tom Warren writes about how Microsoft is embracing Android as the mobile version of Windows: We've seen a variety of ways of bringing Android apps to Windows in recent years, including Bluestacks and even Dell's Mobile Connect software. This app mirroring is certainly easier to do with Android, as it's less restricted than iOS. Still, Microsoft's welcoming embrace of Android in Windows 10 with this app mirroring is just the latest in a number of steps the company has taken recently to really help align Android as the mobile equivalent of Windows. Microsoft Launcher is designed to replace the default Google experience on Android phones, and bring Microsoft's own services and Office connectivity to the home screen. It's a popular launcher that Microsoft keeps updating, and it's even getting support for the Windows 10 Timeline feature that lets you resume apps and sites across devices. All of this just reminds me of Windows Phone. It's only been three years since Microsoft launched its Lumia 950 Windows 10 Mobile device at a packed holiday hardware event. Windows Phone has vanished in the last couple of years, and Microsoft finally admitted Windows Phone was dead nearly a year ago. The software maker has now embraced the reality that people don't need Windows on a phone. Instead, it's embracing Android as the mobile version of Windows.' -- source: https://tech.slashdot.org/story/18/10/03/2051239 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Alphabet's Intra App Encrypts DNS Queries To Help Users Bypass Online Censorship
by Peter Reutemann 03 Oct '18

03 Oct '18

'Catalin Cimpanu, writing for ZDNet: Jigsaw, a technology incubator created by Google and operated as a subsidiary under the Alphabet brand, has released today an Android app named Intra that can encrypt DNS queries as a protection against DNS manipulation at the ISP (internet service provider) level. DNS manipulation is one of the most common forms of online censorship used by oppressive regimes or unscrupulous ISPs, used to block access to news sites, information portals, social media platforms, undesirable software, and more. Intra protects against DNS manipulation by keeping DNS traffic hidden from third-parties with state-level surveillance capabilities, such as internet service providers in countries with autocratic regimes. Reports suggest that Alphabet tested the app with a few dozen political activists in Venezuela before the global roll-out.' -- source: https://yro.slashdot.org/story/18/10/03/2042219 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

ungoogled-chromium
by Lawrence D'Oliveiro 03 Oct '18

03 Oct '18

Even though the Chromium browser is Open Source, it still does a whole lot of communication with Google’s servers, when it’s built and when it runs. This project <https://github.com/Eloston/ungoogled-chromium> tries to strip out all of that, while preserving the user-visible behaviour as much as possible.

1 0

Aussie Law >> Maths
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

"The laws of Australia prevail in Australia, I can assure you of that," [Malcolm Turnbull] said on Friday. "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia." <https://www.techdirt.com/articles/20170714/10385237789/aussie-prime-ministe…>

1 2

Who Needs Special Hardware Random Number Generators?
by Lawrence D'Oliveiro 02 Oct '18

02 Oct '18

The weak point in any encryption system has long been: how random are your random numbers? Providing special hardware for generating random numbers, special CPU instructions etc has always been open to the objection that their randomness could be subverted -- whether through some minor stupid mistake in implementation, or deliberately by certain powerful agencies -- and you would never know. Now, a new research paper <https://www.theregister.co.uk/2018/10/01/hardware_random_numbers/> proposes that normal CPU operation itself can be a source of random numbers. And the way these are obtained would in fact be very hard to subvert, since it is based on detecting subtle timing variations in the operations of various circuits. In other words, it is obtaining randomness from hardware that is not designed to be working randomly at all. And this should -- hopefully -- make the randomness very difficult to compromise.

1 0

NZ Customs Can Now Demand You Unlock Your Phone
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

You can now face a $5,000 fine for not unlocking your phone if ordered to do so, when coming into NZ <https://www.theregister.co.uk/2018/10/01/nz_border_customs/>. Justice Minister Andrew Little says: “The bill provides for that power of search and examination, but in order to exercise that power, a customs officer, first of all, has to be satisfied, or at least to have a reasonable suspicion, that a person in possession of such a device—it would be a cellphone or a laptop or anything else that might be described as an 'e-device'—has been involved in criminal offending.” Howver, ... the Council of Civil Liberties criticised the “reasonable cause” protection as inadequate, because someone asked to unlock a device isn't told what that cause might be, and therefore has no way to challenge the request.

1 0

Five-Eyes Intelligence Services Choose Surveillance Over Security
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

The “Five Eyes” intelligence group (which includes New Zealand) have issued a statement where they claim that the increasing use of secure encryption is endangering law and order and national security. Here is one of many reactions <https://www.schneier.com/blog/archives/2018/09/five-eyes_intel.html>. This whole claim has been repeated so many times it is getting tedious. This group, of all people, with access to the most qualified pool of cryptographic talent in the world, should be able to get an opinion from their own experts on whether this is doable or not -- and if it was, they could show us all how it’s done and make Bruce Schneier and all the rest of the open community of security researchers look like fools. But they won’t do that, because they can’t. Instead, we see this ongoing harping on the issue, as though it can magically be fixed by passing a law or two. The UK (among other countries) has already criminalized the failure to disclose decryption keys <https://en.wikipedia.org/wiki/Key_disclosure_law>, and decreed that forgetting the key is no excuse.

1 1

Wellywood’s Digital Edge Has Dulled
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

You may have seen an item in the news lately about a report into the large amount of subsidies that the Government puts into the local film industry. This latest report says that these subsidies pay off in jobs and revenue elsewhere, but independent reviewers question this, saying such conclusions are very sensitive to initial assumptions <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120795…>. This extract from one of the linked documents caught my eye: Weta Digital executives ... considered that 10 years ago they were at the forefront of technology and that studios were forced to use them to achieve particular effects, they said that this is no longer true: “the degrees of difference in technology are almost imperceptible”. It is no longer technical capability that wins work, it is price point; they consider themselves a price taker. “If the grant were to disappear tomorrow it would call into question the business itself…the subsidy allows us to compete.” There is “no scenario” where the US studios would pay 20% more for Weta Digital than its competitors. VFX have long been a commodity; it’s actually surprising that Weta Digital has managed to last this long, compared to, say, Rhythm & Hues, which went bust shortly after winning an Oscar for “Life Of Pi” <http://www.fresnobee.com/news/nation-world/national/article128729769.html>. I guess it’s all down to those Government subsidies...

1 1

PB Tech Pleads Guilty To Extended Warranty, Advertising Shenanigans
by Lawrence D'Oliveiro 01 Oct '18

01 Oct '18

PB Tech has admitted not properly informing customers of their rights over extended warranties, and also promoting a special offer on Apple watches to 100,000 people when it only had 14 in stock at that price. <https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=120824…>

1 1

An Open Source Resistance Takes Shape as Tech Giants Race To Map the World
by Peter Reutemann 01 Oct '18

01 Oct '18

'Shadma Shaikh, reporting for FactorDaily: Chetan Gowda, 27, was speaking to a room full of students in IIIT Hyderabad for a workshop on OpenStreetMap for beginners organized by Swecha, a non-profit organization to support free software movement last month. There were close to 40 students in the room. Beginners often ask him: Why use open source maps when we already have Google Maps? For Gowda, it was the fact that Google Maps is a global, commercial product and did not capture local detail. Like the old banyan tree that was a major landmark in his hometown Hassan or public benches just outside the town where pedestrians could stop to catch a break or fire catchment areas in Bellandur lake in Bengaluru, India. "It was fascinating to add little but important details of my town to open maps," says Gowda who was introduced in 2013 to OSM or OpenStreetMap, a global community of mappers formed as a collaborative project to create a free editable map of the world in 2004. Since then he has been an active contributor to OpenStreetMap and has conducted many workshops in colleges and institutes to induct more people in the community. Gowda has made 8500 edits in the OpenStreetMap, mainly covering areas in Bengaluru, Hassan and Hyderabad. Gowda and a few other contributors from India are part of a tiny yet growing resistance movement which doesn't want giant corporations to own all the mapping data. For the average consumer, this may not seem like a big deal. But mapping is big business. The market opportunity for suppliers of mapping to the autonomous car industry is going to be worth over $24 billion by 2050, according to one estimate [PDF]. And that's just one industry. A study commissioned by Google in 2015 estimated that industries that run on top of the Global Positioning Satellite Systems and mapping generate nearly $73 billion in annual revenue. Worldwide, that industry is was estimated to generate $150- $270 billion in revenues. Although new research isn't available, with growing smartphone usage and the birth of companies such as Uber and many others it is safe to assume that the industry has only grown bigger. All the more reason why map data can't be held by only a few companies. With Google Maps beginning to charge small and medium-sized businesses and indie developers more for access to its platform, many have started to explore and switch to open source alternatives of Maps, and commercial services such as Here Maps. ' -- source: https://news.slashdot.org/story/18/10/01/1140259 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

VideoLAN Announces Dav1d, a New Libre and Open Source AV1 Decoder
by Peter Reutemann 01 Oct '18

01 Oct '18

'Jean-Baptiste Kempf, president of VideoLan and developer of VLC media player, made the following announced Monday: AV1 is a new video codec by the Alliance for Open Media, composed of most of the important Web companies (Google, Facebook, Netflix, Amazon, Microsoft,...). AV1 has the potential to be up to 20% better than the HEVC codec, but the patents license is totally free, while HEVC patents licenses are insanely high and very confusing. The reference decoder for AV1 is great, but it's a research codebase, so it has a lot to improve. Therefore, the VideoLAN, VLC and FFmpeg communities have started to work on a new decoder, sponsored by the Alliance of Open Media. The goal of this new decoder is: be small, be as fast as possible, be very cross-platform, correctly threaded, libre and (actually) Open Source. Without further due, the code: https://code.videolan.org/videolan/dav1d ' -- source: https://news.slashdot.org/story/18/10/01/1946250 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0